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Abstract 


Intrusion detection is a surveillance problem of practical import that is well suited to wireless sensor networks. In 
this paper, we study the application of sensor networks to the intrusion detection problem and the related problems 
of classifying and tracking targets. Our approach is based on a dense, distributed, wireless network of multi-modal re- 
source-poor sensors combined into loosely coherent sensor arrays that perform in situ detection, estimation, compres- 
sion, and exfiltration. We ground our study in the context of a security scenario called “‘A Line in the Sand” and 
accordingly define the target, system, environment, and fault models. Based on the performance requirements of the 
scenario and the sensing, communication, energy, and computation ability of the sensor network, we explore the design 
space of sensors, signal processing algorithms, communications, networking, and middleware services. We introduce 
the influence field, which can be estimated from a network of binary sensors, as the basis for a novel classifier. A con- 
tribution of our work is that we do not assume a reliable network; on the contrary, we quantitatively analyze the effects 
of network unreliability on application performance. Our work includes multiple experimental deployments of over 90 


* This work was supported by DARPA contract OSU-RF\#F33615-01-C-1901. 

“ Corresponding author. 

E-mail addresses: anish@cis.ohio-state.edu (A. Arora), duttap@cis.ohio-state.edu (P. Dutta), bapat@cis.ohio-state.edu (S. Bapat), 
vinodkri@cis.ohio-state.edu (V. Kulathumani), zhangho@cis.ohio-state.edu (H. Zhang), naik@cis.ohio-state.edu (V. Naik), 
mittalv@cis.ohio-state.edu (V. Mittal), caohu@cis.ohio-state.edu (H. Cao), demirbas@cis.ohio-state.edu (M. Demirbas), gouda@cs. 
utexas.edu (M. Gouda), yrchoi@cs.utexas.edu (Y. Choi), herman@cs.uiowa.edu (T. Herman), sandeep@cse.msu.edu (S. Kulkarni), 
arumugam@cse.msu.edu (U. Arumugam), mikhail@cs.kent.edu (M. Nesterenko), avora@cs.kent.edu (A. Vora), mmiyashi@cs.kent. 
edu (M. Miyashita). 


1389-1286/$ - see front matter © 2004 Elsevier B.V. All rights reserved. 
doi:10.1016/j.comnet.2004.06.007 


606 A. Arora et al. | Computer Networks 46 (2004) 605-634 


sensor nodes at MacDill Air Force Base in Tampa, FL, as well as other field experiments of comparable scale. Based on 
these experiences, we identify a set of key lessons and articulate a few of the challenges facing extreme scaling to tens or 


hundreds of thousands of sensor nodes. 
© 2004 Elsevier B.V. All rights reserved. 
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1. Introduction 


Deeply embedded and densely distributed net- 
worked systems that can sense and control the 
environment, perform local computations, and 
communicate the results will allow us to interact 
with the physical world on space and time scales 
previously imagined only in science fiction. This 
enabling nature of sensor actuator networks has 
contributed to a groundswell of research on both 
the system issues encountered when building such 
networks and on the fielding of new classes of 
applications [1,2]. Perhaps equally important is 
that the enabling nature of sensor networks pro- 
vides novel approaches to existing problems, as 
we illustrate in this paper in the context of a 
well-known surveillance problem. 

Background. The instrumentation of a milita- 
rized zone with distributed sensors is a decades- 
old idea, with implementations dating at least as 
far back as the Vietnam-era Igloo White program 
[3]. Unattended ground sensors (UGS) exist today 
that can detect, classify, and determine the direc- 
tion of movement of intruding personnel and vehi- 
cles. The Remotely Monitored Battlefield Sensor 
System (REMBASS) exemplifies UGS systems in 
use today [3]. REMBASS exploits remotely moni- 
tored sensors, hand-emplaced along likely enemy 
avenues of approach. These sensors respond to 
seismic-acoustic energy, infrared energy, and mag- 
netic field changes to detect enemy activities. 
REMBASS processes the sensor data locally and 
outputs detection and classification information 
wirelessly, either directly or through radio repeat- 
ers, to the sensor monitoring set (SMS). Messages 
are demodulated, decoded, displayed, and re- 
corded to provide a time-phased record of intruder 
activity at the SMS. 

Like Igloo White and REMBASS, most of the 
existing radio-based unattended ground sensor 


systems have limited networking ability and 
communicate their sensor readings or intrusion 
detections over relatively long and frequently 
uni-directional radio links to a central monitoring 
station, perhaps via one or more simple repeater 
stations. Since these systems employ long commu- 
nication links, they expend precious energy dur- 
ing transmission, which in turn reduces their 
lifetime. For example, a REMBASS sensor node, 
once emplaced, can be unattended for only 30 
days. 

Recent research has demonstrated the feasibil- 
ity of ad hoc aerial deployments of 1-dimensional 
sensor networks that can detect and track vehicles. 
In March 2001, researchers from the University of 
California at Berkeley demonstrated the deploy- 
ment of a sensor network onto a road from an un- 
manned aerial vehicle (UAV) at Twentynine 
Palms, California, at the Marine Corps Air/ 
Ground Combat Center. The network established 
a time-synchronized multi-hop communication 
network among the nodes on the ground whose 
job was to detect and track vehicles passing 
through the area over a dirt road. The vehicle 
tracking information was collected from the sen- 
sors using the UAV in a flyover maneuver and 
then relayed to an observer at the base camp. 

Overview of the paper. In this work, we define, 
investigate, design, build, and field a dense, distrib- 
uted, and 2-dimensional sensor network-based 
surveillance system using inexpensive sensor 
nodes. Such an approach relaxes the 1-dimen- 
sional constrained motion model and instead offers 
fine-grained detection and tracking within an area 
but along any arbitrary 2-dimensional path. In this 
model, intrusion data are processed locally at each 
node, shared with neighboring nodes if an anom- 
aly is detected, and communicated to an exfiltra- 
tion gateway with wide area networking 
capability. The motivation for this approach 
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comes from the spatial- and temporal-locality of 
environmental perturbations during intrusions, 
suggesting a distributed approach that allows indi- 
vidual sensor nodes, or clusters of nodes, to per- 
form localized processing, filtering, and triggering 
functions. Collaborative signal processing enables 
the system to simultaneously achieve better sensi- 
tivity and noise rejection, by averaging across time 
and space, than is possible with an individual node 
which averages only across time. 

Our approach thus demonstrates how dense, 
resource-constrained sensor networks yield im- 
proved spatial fidelity of sampling the environ- 
ment. More specifically, we introduce a spatial 
statistic called the influence field, realize an estima- 
tor for it using a binary sensor field, and use it as 
the basis for a new type of classifier. Informally, 
the influence field is the spatial region surrounding 
an object in which the object causes fluctuations in 
one or more of the six energy domains. In other 
words, the influence field is the region surrounding 
the object in which the object can be sensed using 
some specific modality. We are unaware of prior 
work that estimates the influence field from a set 
of spatially diverse samples or uses the influence 
field to classify an object in this manner. 

Our approach complements and improves upon 
existing unattended battlefield ground sensors by 
replacing the typically expensive, hand-emplaced, 
sparsely-deployed, non-networked, and transmit- 
only sensors with integrated collaborative sensing, 
computing, and communicating nodes. Such an 
approach will enable military forces to blanket a 
battlefield with easily deployable and low-cost sen- 
sors, obtaining fine-grained situational awareness 
enabling friendly forces to see through the ‘“‘fog 
of war” with precision previously unimaginable. 
A strategic assessment workshop organized by 
the US Army Research Lab concluded: 


It is not practical to rely on sophisticated sensors 
with large power supply and communication [de- 
mands]. Simple, inexpensive individual devices de- 
ployed in large numbers are likely to be the source 
of battlefield awareness in the future. As the num- 
ber of devices in distributed sensing systems in- 
creases from hundreds to thousands and perhaps 
millions, the amount of attention paid to network- 


ing and to information processing must increase 
sharply. 


Our work focuses attention on the question of 
whether existing sensor systems can be simply aug- 
mented with networking to realize the benefits of 
sensor networks. Indeed, much of the research in 
sensor networks is aimed at addressing key net- 
working problems like time synchronization, node 
localization, and routing in the context of con- 
strained cost and power. However, as this paper 
demonstrates, the simple addition of ‘“network- 
ing” to an application may not achieve the desired 
level of performance. Instead, we must address 
simultaneously, several additional topics including 
data compression, information exfiltration, and 
network tuning. In other words, co-design of the 
entire system is an essential, but often ignored, ele- 
ment of sensor network system design. This paper 
emphasizes co-design and demonstrates the subtle 
dependencies between the various subsystems. Our 
approach enables top-to-bottom requirements 
traceability. 

The main contribution of our work is that it 
demonstrates, through a proof of concept system 
implementation, that it is possible to discriminate 
between multiple object classes using a network 
of binary sensors. We then demonstrate, through 
a proof of performance, that our implementation 
provides a tunable level of classification quality 
based on the reliability of the network. To achieve 
these goals, we realize the concept of an influence 
field. Although influence fields have been used in 
other contexts like tracking, we believe our work 
represents its first use as the basis for classification. 
We have demonstrated both theoretically and 
experimentally that the influence field provides a 
basis for distributed classification. We have also 
demonstrated the robustness of this feature in a 
real system, even in the presence of node failures 
and severe network unreliability. Each node can 
send out as little as one bit of information about 
the presence or absence of a target in its sensing 
range and only requires local detection and estima- 
tion, but no computationally complex time-fre- 
quency domain signal processing. 

Organization of the paper. Section 2 reviews 
related work on detection, classification, and 
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tracking using sensor networks. Section 3 describes 
the user requirements of a surveillance system, for- 
mulates more precise metrics, and establishes the 
target, system, environment, and fault models. 
This problem formulation, along with the special 
constraints of sensors networks, guides the explo- 
ration of the design space in Section 4. Section 5 
identifies potential sensors which could be used 
to detect the target classes of interest, analyzes 
the suitability of these sensors for use in wireless 
sensor networks, and ties together the problem 
specification, design considerations, and sensing 
modalities to identify an appropriate sensor suite 
for achieving the detection and classification 
requirements. Section 6 considers signal detection 
and parameter estimation. Section 7 describes the 
goals of the classification system and introduces 
the influence field as a spatial statistic suitable 
for classification purposes. Section 8 discusses the 
goals of tracking and describes an influence field- 
based approach to the problem. Section 9 estab- 
lishes the requirements for neighborhood- and 
network-wide time synchronization based on the 
demands of classification and tracking. Section 
10 describes the communications, networking, 
and routing aspects of our application. Section 
11 describes the system architecture, sensor net- 
work nodes, sensor boards, packaging, and other 
implementation details. Section 12 discusses some 
of the challenges and failures we encountered dur- 
ing the development and fielding of this system 
and outlines approaches to mitigate some of these 
problems. Finally, Section 13 summarizes our re- 
sults, discusses our future plans, and provides 
our concluding thoughts. 


2. Related work 


Detection, classification and tracking of targets 
is a basic surveillance or military application, and 
has hence received a considerable amount of atten- 
tion in the literature. Recent developments in the 
miniaturization of sensing, computing, and com- 
munications technology have made it possible to 
use a plurality of sensors within a single device 
or sensor network node. Their low cost makes it 
feasible to deploy them in significant numbers 


across large areas and consequently, these devices 
have become a promising candidate for addressing 
the distributed detection, classification, and track- 
ing problem. A variety of approaches have been 
proposed that range over a rich design space such 
as purely centralized to purely distributed, high 
message complexity to high computational com- 
plexity and data fusion-based to decision fusion- 
based. 

In contrast to our work, much of the work on 
target classification in sensor networks has used 
a centralized approach. This typically involves pat- 
tern recognition or matching using time-frequency 
signatures produced by different types of targets. 
Caruso et al. [7] describe a purely centralized vehi- 
cle classification system using magnetometers 
based on matching magnetic signatures produced 
by different types of vehicles. However, this and 
other such approaches impose high computational 
burden on individual nodes. They also require sig- 
nificant a priori configuration and control over the 
environment. In [7], the vehicle has to be driven di- 
rectly over the sensor for accurate classification 
and at random orientations and distances, the sys- 
tem can only detect presence. 

The spatial density and redundancy that is 
possible due to the diminishing cost of a single 
node favors highly distributed models. Me- 
esookho et al. [8], describe a collaborative classi- 
fication scheme based on _ exchanging local 
feature vectors. The accuracy of this scheme, 
however, improves only as the number of collab- 
orating sensors increases, which imposes a high 
load on the network. By way of contrast, Duarte 
et al. [6] describes a classifier in which each sensor 
extracts feature vectors based on its own readings 
and passes them through a local pattern classifier. 
The sensor then transmits only the decision of the 
local classifier and an associated probability of 
accuracy to a central node that fuses all such 
received decisions. This scheme, while promis- 
ing since it only slightly loads the network, re- 
quires significant computational resources at 
each node. 

The topic of distributed tracking using sensor 
networks has received a considerable amount of 
attention recently. Most of this work is based on 
collaborative signal and information processing, 
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sequential Bayesian filtering, and extended Kal- 
man filtering [9-11]. Other solutions for tracking 
in a sensor network are based on a Kalman filter 
approach [4,12,13]. These approaches attempt to 
estimate the future position of a target given its 
past and present positions. However, such estima- 
tion tends to require considerable computational 
resources and we are unaware of implementations 
that can run on the class of devices we consider for 
our sensor nodes [14]. The constraints of network 
reliability and load permit sending only a limited 
amount of data over the network, and in some ex- 
treme cases, even a single bit of data. Such binary 
networks have been used in previous work for 
tracking [5]. However, the robustness of these ap- 
proaches in the presence of network unreliability 
is not demonstrated. 

We use the notion of an influence field for 
tracking. The notion of influence of an energy 
source is used in many science and engineering 
applications. Zhao et al. [9] define an influence area 
as the number of sensors that “hear” an object. 
Our definition of the influence field also captures 
the shape of the influence of the object. Zhao 
et al. [9] suggest that the influence area can be used 
to track multiple targets that are separated in 
space. However, we believe we are the first to actu- 
ally demonstrate the robustness of this approach 
in tracking in a network wherein the unreliability 
is as high as 50%. 


3. Problem formulation 


The operational problem that this work ad- 
dresses is enabling military personnel to “‘put trip- 
wires anywhere.” This section specifies the user 
requirements of the surveillance system, formu- 
lates the system’s performance metrics, and estab- 
lishes the target, system, environment, and fault 
models. Adlakha et al. [15] identified four key, suf- 
ficient, and independent user level quality-of-serv- 
ice (QoS) parameters appropriate for sensor 
networks including density, spatial-temporal accu- 
racy, latency, and lifetime. All of these parameters 
are central in our work, although we do relax 
somewhat the lifetime parameter by not specifying 
a minimum system lifetime. Issues of cost and size 


are also important since they can directly affect the 
QoS parameters. 


3.1. User requirements and performance metrics 


We consider a surveillance application scenario 
called ‘A Line in the Sand.” The objective of this 
scenario is to identify a breach along a perimeter 
or within a region. The intruding object, or target, 
may be an unarmed person, a soldier carrying a 
ferrous weapon, or a vehicle. The three fundamen- 
tal user requirements of this application are target 
detection, classification, and tracking. The system 
user specifies several QoS parameters that affect 
how well the system detects, classifies, and tracks 
targets. In addition to these QoS parameters, the 
user defines the area or border to be protected. 

Detection requires that the system discriminate 
between a target’s absence and presence. Success- 
ful detection requires a node to correctly estimate 
a target’s presence while avoiding false detections 
in which no targets are present. The key perform- 
ance metrics for detection include the probability 
of correct detection, or Pp, the probability of false 
alarm, or Pra, and the allowable latency, Tp be- 
tween a target’s presence and its eventual detec- 
tion. 

Classification requires that the target type be 
identified as belonging to one of several classes 
including person, soldier, and vehicle. More gener- 
ally, classification is the result of M-ary hypothesis 
testing and depends on estimation, which is the 
process of determining relevant parameters of the 
detected signal including, for example, its peak 
amplitude, phase, duration, power spectral den- 
sity, etc. Successful classification requires that tar- 
gets are labelled by the system as being members of 
the class to which they actually belong. The key 
performance metrics for classification are the 
probability of correctly classifying (labelling) the 
ith class, Pc, and the probability of misclassifying 
the ith class as the jth class, or PGs 

Tracking involves maintaining the target’s posi- 
tion as it evolves over time due to its motion in a 
region covered by the sensor network’s field of 
view. Successful tracking requires that the system 
estimate a target’s initial point of entry and current 
position with modest accuracy and within the 
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allowable detection latency, Tp. Implicit in this 
requirement is the need for target localization. 
The tracking performance requirements dictate 
that tracking accuracy, or the maximum difference 
between a target’s actual and estimated position, 
be both bounded and specified, within limits, by 
the user. The system is not required to predict 
the target’s future position based on its past or pre- 
sent position. 

Table 1 summarizes the overall performance re- 
quired from the system while Table 2 provides a 
detailed set of classification performance require- 
ments. These requirements were gathered through 
an iterative process of working through several 
realistic operational scenarios, and specifically tak- 
ing into account the requirements of military oper- 
ators in each of these scenarios. The requirements 
listed here are thus a convergence of acceptable 
performance for a fielded military system and a 
reasonable expectation of what the state of the 
art is capable of delivering. 


3.2. Target models 


This section specifies kinematic motion models 
of the three target classes: an unarmed person, a 
soldier carrying a ferrous weapon, and a vehicle. 
The target motion models are 2-dimensional ran- 
dom walks with normally and/or uniformly dis- 
tributed speeds, accelerations, and bearings. The 
probability distributions are largely unconstrained 
with the notable exceptions of bounded velocity, 
Vmin Which is necessary to ensure track continuity 
and Vinax which is necessary to compute sampling 
rates, and realistically bounded accelerations. De- 
spite the relatively unconstrained target motion 


Table 1 

Summary of the performance requirements 

Metric Value Description 

Pp >0.95 Probability of detection 

Pra <0.10 Probability of false alarm 

Tp <15 Detection latency (s) 

Pojizj Table 2 Probability of correct 
classification 

Pojiz; Table 2 Probability of misclassification 

(%, 9) €(x, y)£(2.5,2.5) Position estimation error (m) 


Table 2 

Summary of the required classification confusion matrix 
Person Soldier Vehicle 

Person Po, , > 90% Po. < 9% Poy < 1% 

Soldier Po, <1% Po. > 95% Poy <4% 

Vehicle Po, = 0% Po. <1% Po, > 99% 


Vertical labels are the true class labels and horizontal labels are 
the classifier labels. A person is considered a small threat; a 
soldier is a greater threat than an unarmed person; a vehicle 
is the greatest threat. Consequently, it is more important that 
a greater threat not be misclassified as a lesser threat than 
vice versa. 


models, we assume the existence of prior probabil- 
ities for each target class. For example, a normally 
distributed walking speed and generally constant 
heading are assumed for an unarmed person. A 
soldier, however, is equally likely to crawl, walk 
or run, and may change directions frequently, 
resulting in a uniform distribution of the prior 
probabilities for speed, and wider tails on a nor- 
mally distributed bearing model than unarmed 
persons. Vehicles exhibit a greater range of speeds 
but more constant and constrained headings than 
either unarmed persons or soldiers, resulting in a 
wider distribution and greater mean velocity, but 
a tighter distribution for bearing. Table 3 summa- 
rizes these constraints. 

We assume that all targets actually belong to 
one of the specified classes. In other words, we do 
not consider questions of misclassifying, for exam- 


Table 3 

Summary of the target motion models 

Constraint Value Description 

Viinax 25 Maximum velocity (kmph) 
Vinin 1 Minimum velocity (kmph) 
Vp ~ V(5,1) Person speed (kmph) 

Ap ~ U1, 1] Person acceleration (m/s”) 
Op ~ NV (0,1) Person bearing (rad) 

Vs ~ U1, 20] Soldier speed (kmph) 

A, ~ U|-3, 3] Soldier acceleration (m/s”) 
Os ~ NV (0,2) Soldier bearing (rad) 

Vy ~ U1, 25] Vehicle speed (kmph) 

Ay ~ U\—5, 5] Vehicle acceleration (m/s”) 
Oy ~ NV (0,0.25) Vehicle bearing (rad) 


The acceleration distributions are relative to the target’s current 
speed and the bearing distributions are relative to the target’s 
current bearing. 
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ple, a non-human mammal as an unarmed person. 
Furthermore, the track entanglement that results 
from the presence of multiple targets simultane- 
ously occupying the same space and time is com- 
plex, and we are unaware of efficient distributed 
algorithms to disentangle these tracks, despite ac- 
tive research in this area [13,16]. We also observe 
the impossibility of disentangling the tracks of mul- 
tiple targets of the same class without additional 
constraint information like target motion models 
or individual target velocities. Consequently, we 
make the simplifying assumption that if multiple 
targets are present in the sensor network, their tra- 
jectories will not coincide in both space and time. 
Section 5 considers the phenomenology of the tar- 
get models in the six energy domains. 


3.3. System model 


The system consists of a large number of nodes 
distributed over an extended geographic area that 
is to be monitored. We do not assume careful 
placement of these nodes so the nodes can be de- 
ployed with some degree of randomness as they 
might be in a typical military deployment scenario. 
We do assume, however, that the nodes are de- 
ployed with generally uniform density, p, subject 
to some local variations. We also assume that this 
density is sufficient to guarantee redundant cover- 
age of the region to be monitored and that a local- 
ization service exists that can provide each node’s 
relative or absolute position. 

Each node in the network has a unique identi- 
fier and consists of a processing unit, memory, 
radio, power source, and one or more sensors of 
different types. The capabilities of these nodes 
are limited due to size, cost, and lifetime con- 
straints. A single node has limited processing 
power, memory, and energy so that complex or 
computation intensive algorithms cannot be exe- 
cuted on an individual node. The communication 
range of these nodes is also limited such that the 
entire network cannot be traversed in a single 
hop. For purposes of exfiltration of the classifica- 
tion and tracking results, one or more of the nodes 
may be attached to a relay which can transmit 
these results over longer distances or over a satel- 
lite link to a remote base station. 


The communication medium is wireless and 
broadcast is the basic communication primitive. 
In the wireless broadcast model, messages are sub- 
ject to fading and other propagation losses. Mes- 
sages from nearby nodes may collide with each 
other if they are sent at the same time. Even if 
the transmitting nodes are not in each other’s com- 
munication radius, their messages could still col- 
lide at a receiver node and be lost. 


3.4. Environment model 


Eventually, we expect that derivatives of our 
work will find themselves being deployed on real 
battlefields by actual military personnel. As a re- 
sult, we make our environment model reality itself 
and accept the harshness that comes with this deci- 
sion. While we cannot account for all of the envi- 
ronmental factors that might affect the system, we 
address the ones that are most likely to adversely 
affect the correctness and performance of our sen- 
sors, protocols, and algorithms. Cases in which we 
must make decisions between extensive engineer- 
ing and a milder environment, we usually pick 
the latter and note the decision and the system’s 
shortcomings. In the remainder of this section, 
we discuss weather effects, geographic variations, 
and noise model. 

Wind can affect the sensors and cause a flurry of 
false positives by directly moving the sensor, indi- 
rectly through wind “noise,” or by moving nearby 
objects like grass, bushes, and trees. Since the 
probability of false alarm, or Pra, is an important 
system performance metric, we are motivated to 
engineer the sensors to withstand wind gusts and 
their attendant effects on the nearby environment. 
Rain can adversely affect both sensors and signal 
propagation. Furthermore, rain occurs frequently 
enough in nature that we were concerned enough 
with it to design waterproof containers. We allow 
for the possibility of snow but expect that it will 
melt away quickly enough that the sensors do 
not run out of stored energy before getting a 
chance to recharge using energy harvested from 
the sun. However, we do not actually test our sys- 
tem in the snow. Military specifications typically 
call for a wide operating temperature range span- 
ning —40 to +85 °C but designing such systems 
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is a well-understood concern of electrical and 
mechanical engineering, and does not contribute 
to the novelty of this research. As a result, it is 
not considered. 

Both uneven terrain and the presence of obsta- 
cles can affect dramatically the quality of communi- 
cations between nodes as well as the quality of 
sensing at a node. We make two assumptions in re- 
gards to terrain and obstacles. The first assumption 
is that the nodes remain sufficiently connected such 
that the network does not partition into multiple 
connected components that are disjoint from each 
other. The second assumption is that terrain does 
not affect a statistically significant number of sen- 
sors. We also note that the Earth’s magnetic field 
constantly varies with a time-varying rate of 
change. This phenomenon requires that the system 
adapt to a changing ambient magnetic field. 

The noise parameters are unknown but we as- 
sume that noise power is upper bounded. Further- 
more, we assume that the noise has an unknown 
probability density function, is not wide sense sta- 
tionary, and the noise samples are not independent 
and identically distributed. We choose such a 
mathematically intractable noise model, in contrast 
to a Gaussian noise model, because our early 
experiments indicate that environmental noise 
tends to have more spikes or outliers than Gaussian 
noise, that some of these outliers tend to be corre- 
lated, and that the noise statistics change with time. 


3.5. Fault model 


Sensor networks are subject to a wide variety of 
faults and unreliability. Inexpensive hardware, 
limited resources, and extreme environmental con- 
ditions all contribute to causing these faults. In 
this section, we describe the types of faults that 
may affect the correctness and performance of 
our system. 

Node failures and hardware faults. During 
deployment, sensors may be dropped from high 
altitudes so some nodes may not survive the fall. 
In some cases, the sensors may become debonded 
from the node due to ground impact and cause 
intermittent or continuous false alarms or misses, 
resulting in seemingly Byzantine behavior. Some 
nodes may run out of power due to the limited on- 


board energy resources. Nodes may be displaced 
from their original positions by the targets them- 
selves or due to environmental factors. Sensors 
may become desensitized due to heat or moisture 
and report readings that are railed high, railed 
low, or even arbitrary. 

Communication faults. Broadcast, the basic 
communication primitive in the network, leads to 
message losses from collisions when two nodes 
within range of each other transmit simultane- 
ously. Even if the transmitting nodes are not in 
each other’s transmission range, messages can still 
collide and be lost at a receiver due to the hidden 
terminal effect. Even in the absence of collisions, 
messages may still be lost as a result of fading dur- 
ing propagation over the wireless medium. The in- 
ter-node distance, altitude difference, antenna 
polarization, environmental conditions, and pres- 
ence of obstacles are all factors that contribute 
to the fading characteristics of a wireless link. 

Software faults. The limited computational re- 
sources available on a node impose some restric- 
tions on the amount of processing that can be 
successfully performed at the node. If this limit is 
exceeded, processing tasks may not run to comple- 
tion causing non-deterministic behavior and vari- 
ous kinds of failures. Pointers and memory 
locations may get corrupted, message buffers 
may be overwritten, and certain sensing and 
processing events might get lost. The node might 
even be forced into deadlock or livelock states 
from which it cannot recover on its own. 


4. Design considerations 


In this section, we outline several design con- 
straints which influenced the overall design of the 
system. These design considerations, although 
not stated explicitly in the form of user require- 
ments, played a significant part in the selection 
of the algorithms and techniques for solving the 
problem under consideration. 


4.1. Reliability 


The unreliability of sensor networks has a sig- 
nificant impact on the system design for classifica- 
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tion and tracking, particularly while selecting the 
feature that serves as the basis of classification. 
There are two fundamental approaches to choose 
from while doing feature selection—centralized 
and distributed. The centralized approach typi- 
cally involves doing a time-frequency series analy- 
sis followed by some kind of signature matching 
algorithm. However, since the nodes in our system 
have limited computational power, performing 
these computation-intensive tasks would have 
overburdened an individual node. Also, the phe- 
nomenon to be detected and classified, viz. a target 
moving through the field, itself is distributed both 
in space and time. For this reason, we concen- 
trated our efforts on coming up with a distributed 
feature for the problem at hand. 

Selecting the right distributed feature, however, 
is not an easy problem and involves several design 
tradeoffs. For example, the constrained resources 
of a single node impose restrictions on the features 
that can be extracted locally. Moreover, the unre- 
liable nature of the network and the degradation 
of network performance under load forces us to re- 
duce the amount of data sent out over the net- 
work. Such constraints on local and network 
load forced us to look for a distributed feature 
whose projection on a single node could be effi- 
ciently calculated, whose calculation did not over- 
load the network and yet gave us the desired 
accuracy of classification and tracking. Further- 
more, the feature needed to be robust to network 
failure, i.e., it needed still to work if a few nodes 
failed or messages from a few nodes were lost. 
The resource constraints at a single node and lim- 
itations on the bandwidth and reliability of the 
network thus guided our feature selection into 
coming up with a binary network comprising of lo- 
cal one bit detection decisions from each node 
being sent over the network to a classifying and 
tracking module. 


4.2. Energy 


Ultimately, our systems must survive in the real 
world and consequently, their designs are con- 
strained by practical matters. One such fundamen- 
tal constraint is energy. Wireless sensor nodes 
must use either stored energy (e.g., batteries) or 


harvested energy (e.g., solar cells). The rate at 
which energy can be consumed is constrained by 
either the node’s required lifetime for stored energy 
or by the average rate of energy collected through 
harvesting. 

There are four main ways in which nodes con- 
sume energy: sensing, computing, storing, and 
communicating. Each of these processes consumes 
a different amount of energy for each unit of useful 
work that it performs. In fact, the transmit and re- 
ceive functions involved in communication them- 
selves have different energy consumptions. 

Designing an acceptable system is equivalent to 
finding a weighted mix of these processes that min- 
imally meets the system’s requirements and ideally 
optimizes the system’s overall performance. Recall 
that in Section 3, we relaxed the node lifetime 
requirement by not specifying an actual value. In- 
stead, we will order different algorithms based on 
their complexity along these processes and choose 
the one that is most likely to maximize a node’s 
lifetime. 


4.3. Complexity 


Previously, we equated designing a good system 
to finding a weighted mix of the sensing, comput- 
ing, storing, and communicating processes. The 
algorithms which perform detection, estimation, 
classification, tracking, time synchronization, and 
routing are the ones that will draw on the sensing, 
computing, storage, and communications subsys- 
tems. Therefore, we should focus our attention 
on optimizing the time, space, and message com- 
plexity of these algorithms with respect to their in- 
put parameters. 

For example, we might be interested in the com- 
plexity of our signal detection algorithm as a func- 
tion of sample size, n, or our tracking algorithm as 
a function of the number of messages, m. We also 
need to consider carefully our choice and method 
of collecting features for classification. For exam- 
ple, a classifier based on centralized data fusion 
would have a high message complexity since high 
dimensional data must be communicated. Con- 
versely, a distributed classifier may have a low 
message complexity, transmitting a message only 
when a target is detected, but a high time or space 
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complexity due to the classification algorithm’s 
computing or storage requirements. 


5. Sensing 


The selection of sensors is an important task in 
the design of sensor networks. Choosing the right 
set of sensors for the job at hand can improve dra- 
matically the system’s performance, lower its cost, 
and improve its lifetime. However, there is a fun- 
damental tension between the richness of a sen- 
sor’s output and the resources required to 
process the signals it generates. For example, even 
small cameras have tens of thousands of pixels that 
provide an immense amount of information but 
the vision processing algorithms needed to process 
this vast amount of information often have high 
space, time, or message complexity and therefore 
require significant computational resources. 

In this section, we consider the sensing modes 
appropriate for detecting our target classes—un- 
armed person, armed soldier, and vehicles—based 
on the fluctuations they cause in the six fundamen- 
tal energy domains. First, we identify the target 
phenomenology (i.e., the perturbations to the envi- 
ronment that our potential targets are likely to 
cause). Then, we identify a set of sensors that 
can detect these disturbances and discuss the diffi- 
culty of the signal processing task, using the met- 
rics of space, time, and message complexity, 
required to extract meaningful information from 
these signals. 


5.1. Phenomenology 


Phenomenology is the study of the essence of 
things. In this section, our goal is to find a set of 
essential features whose values are very similar 
for objects in the same categories and very differ- 
ent for objects in different categories. We identify 
features in all six fundamental energy domains 
including optical, mechanical, thermal, electrical, 
magnetic, and chemical. We take such a broad 
view because there is considerable research under- 
way developing MEMS sensors for each of these 
domains. We also note that a variety of sensors 
could detect different aspects of the same energy 


domain. For example, microphones, accelerome- 
ters, and scales all measure mechanical energy, 
but along acoustic, seismic, and potential dimen- 
sions. 

Person. An unarmed person is likely to disrupt 
the environment thermally, seismically, acousti- 
cally, electrically, chemically, and optically. Hu- 
man body heat is emitted as infrared energy 
omnidirectionally from the source. Human foot- 
steps are impulsive signals that cause ringing at 
the natural frequencies of the ground. The reso- 
nant oscillations are damped and propagated 
through the ground. Footsteps also create impul- 
sive acoustic signals that travel through the air at 
a different speed than the seismic effects of foot- 
steps travel through the ground. A person’s body 
can be considered a dielectric that causes a change 
in an ambient electric field. Humans emit a com- 
plex chemical trail that dogs can easily detect. Spe- 
clalized sensors can detect certain chemical 
emissions, as anyone who has used public rest- 
rooms can attest. A person reflects and absorbs 
light rays and can be detected using a camera. A 
person also reflects and scatters optical, electro- 
magnetic, acoustic, and ultrasonic signals. 

Soldier. An armed soldier is likely to have a sig- 
nature that is a superset of an unarmed person’s 
signature. We expect a soldier to carry a gun and 
other equipment that contains steel or other metal. 
As a result, we would expect a soldier to have a 
magnetic signature that most unarmed people 
would not have. A soldier’s magnetic signature is 
due to the disturbance in the ambient (earth’s) 
magnetic field caused by the presence of ferro- 
magnetic material. We might also expect that a 
soldier would better reflect and scatter electromag- 
netic signals like radar due to the metallic content 
on his person. 

Vehicle. A vehicle is likely to disrupt the envi- 
ronment thermally, seismically, acoustically, elec- 
trically, magnetically, chemically, and optically. 
Like humans, vehicles have a thermal signature 
consisting of ‘“‘hotspots” like the engine region 
and a plume of hot exhaust. Both rolling and 
tracked vehicles have detectable seismic and acous- 
tic signatures. Tracked vehicles, in particular, have 
highly characteristic mechanical signatures due to 
the rhythmic clicks and oscillations of the tracks. 
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Vehicles contain a considerable metallic mass that 
affects ambient electric and magnetic fields in an 
area much larger than a soldier. Vehicles emit 
chemicals like carbon monoxide and carbon diox- 
ide as a side effect of combustion. Vehicles also re- 
flect, scatter, and absorb optical, electromagnetic, 
acoustic, and ultrasonic signals. 


5.2. Sensing options 


This section reviews a subset of sensors that are 
well suited for wireless sensor networks in general 
and our application in particular, owing to their 
low power, small size, and low cost. However, 
some of these sensors may be unsuitable from a 
signal processing perspective, but those considera- 
tions have been postponed until a later section. 
Despite the plethora of available sensors, no prim- 
itive sensors exist that detect people, vehicles, or 
other potential objects of interest. For such phe- 
nomena, sensors can be used to detect various fea- 
tures like thermal signature or ferro-magnetic 
content. It can be inferred from the presence of 
these analogues that, with some probability, the 
target phenomenon exists. However, it should be 
clear that this estimation is an imperfect process 
in which multiple unrelated phenomena can cause 
indistinguishable sensor outputs. Additionally, all 
real-world signals are corrupted by noise which 
limits a system’s effectiveness. For these reasons, 
in addition to sensor classification and selection, 
we will discuss the related topics of signal detec- 
tion and parameter estimation in Section 6. 

Passive sensors detect and measure various ana- 
logues of a target including its magnetic, thermal, 
or acoustic signature. Active sensors, such as ultra- 
sonic and radar, can measure a target’s presence, 
range, velocity, or direction of travel by how the 
target modifies, reflects, or scatters a signal trans- 
mitted by the sensor. We consider the following 
sensors in our selection. A more detailed analysis 
of these sensors can be found in [17]. 

Magnetic. Strengths include well defined far- 
field target phenomenologies, discrimination of 
ferrous objects, no line-of-sight requirement, pas- 
sive nature. Weaknesses include poorly defined 
near-field target phenomenologies, limited sensing 
range. 


Radar. Strengths include no __ line-of-sight 
requirement, ability to operate through obstacles, 
estimate velocity, resist jamming. Weaknesses in- 
clude active nature, interference. 

Thermal. Strengths include excellent sensitivity, 
excellent selectivity, passive nature. Weaknesses 
include Fresnel lens requirement, line-of-sight 
requirement. 

Acoustic. Strengths include long sensing range, 
high-fidelity, no line-of-sight requirement, passive 
nature. Weaknesses include poorly defined target 
phenomenologies, moderately high sampling rates, 
high time and space complexity for signal process- 
ing. 

Chemical. Strengths include no _ line-of-sight 
requirement, unique ability to detect gaseous com- 
pounds, passive nature. Weaknesses include lack 
of availability for most chemicals. 

Electric. Strengths include no_ line-of-sight 
requirement, non-contact sensing of non-ferrous, 
fast or slow-moving, cool, quiet, odorless, steady, 
camouflaged objects. Weaknesses include electrode 
placement, nuisance parameters, active nature, 
interference. 

Seismic. Strengths include long sensing range, 
no line-of-sight requirement, passive nature. 
Weaknesses include signal propagation variations 
due to ground composition, moderately high sam- 
pling rates, high time and space complexity for fre- 
quency domain analysis. 

Optical. Strengths include long sensing range, 
high-fidelity, passive nature. Weaknesses include 
poorly defined target phenomenologies, line-of- 
sight requirement, high pixel sampling rates, high 
time and space complexity for signal processing. 

Ultrasonic. Strengths include  multi-echo 
processing that allows sight beyond small obsta- 
cles. Weaknesses include signal propagation 
variations due to temperature and humidity, line- 
of-sight requirement, active nature, interference. 


5.3. Sensor selection 


Section 3 described the user requirements of our 
surveillance system, formulated more precise met- 
rics, and established the target, environment, 
deployment, fault, and system models. This prob- 
lem formulation then drove the exploration of the 
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design space in Section 4. Earlier parts of Section 5 
identified potential sensors which could be used to 
detect the target classes of interest and analyzed the 
suitability of these sensors for use in wireless sensor 
networks. We now relate the problem specification, 
design considerations, target phenomenology, and 
sensing modalities to select our sensor suite. Our 
metrics are summarized below: 


1. Orientation invariant. The sensor can operate 
regardless of its azimuthal and zenith orienta- 
tions. 

2. No special packaging. The sensor does not need 
to be exposed to the environment nor does it 
need special mechanical hardware (e.g., lenses, 
mirrors, etc.). 

3. Reasonable signal processing. The algorithms re- 
quired for signal detection and parameter esti- 
mation are reasonable given the constraints of 
the platform. 

4. Established. The sensors are well characterized, 
commoditized, and available from multiple 
sources. 

5. Long-Range. The sensing range provides ample 
time to sleep between samples. 

6. No line-of-sight. The sensor does not require a 
direct line of sight to the object to detect it. 

7. Co-locatable. Two nearby sensors do not inter- 
fere with each other. 

8. Passive operation. The sensor does not transmit 
a signal. 


We select a set of sensors that are both neces- 
sary and sufficient for the detection and classifica- 
tion requirements. Table 4 lists the sensors that we 
considered earlier along with how they compare 
with our metrics given above. 

We now turn to the problem of identifying a 
sufficient set of sensors that will allow us to detect 
all of our target classes and discriminate among 
them. Magnetic sensors ranked highest in Table 
4 and allow us to detect soldiers and vehicles. Since 
in our model, the only difference in phenomenol- 
ogy ' between a person and a solder is that a sol- 


! However, we do assume some differences in the kinematic 
models. 


dier carries a ferrous weapon, 
discrimination is clearly necessary. 

Even though magnetic detection is necessary, it 
is not sufficient, since a person will not be detected 
at all. Radar sensors ranked second highest in Ta- 
ble 4, and can detect all of the target classes of 
interest. Magnetic and radar sensors together pro- 
vide sufficient information for detection of targets 
and discrimination among them. Recall that one of 
the differences between the soldier and vehicle phe- 
nomenologies is that a vehicle affects the magnetic 
field in an area much larger than a soldier does. It 
should follow, then, that the sensing range of a 
vehicle is greater than the sensing range of a sol- 
dier. If we can determine either the target’s range 
from the sensor at the time of first detection, or 
the size of the area in which a target is detected, 
we can discriminate between soldiers and vehicles. 
We will return to the topic of discriminating be- 
tween targets in Section 7. 


magnetic 


6. Signal detection and parameter estimation 


The signal processing subsystem is responsible 
for sensing, detection, estimation, classification, 
and tracking. This section focuses on the detection 
and estimation aspects of signal processing. From 
a signal processing perspective, signal detection is 
the process of determining when a signal of inter- 
est is present and estimation is the process of deter- 
mining the relevant parameters of the signal. 

To bridge the notion of detecting a target’s pres- 
ence (as described in Section 3) with the notion of 
detecting a signal’s presence (as described in this 
section), we return to our discussion of phenome- 
nology. Specifically, we derive an analytical model 
for each target and sensor type, and use this model 
to determine the sensor output that would result if 
a target were present. We verify our models with 
empirical data from dozens of field experiments. 


6.1. Magnetic 


In this section, we model both a soldier and a 
vehicle as a magnetic dipole and provide analytical 
and empirical results to support our model. A 
moving soldier or vehicle, or more generally, a 
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Table 4 


Summary of the strengths and weaknesses of the sensors under consideration 


Sensor type Orientation No special Reasonable Established 


Long range No line-of-sight Co-locatable Passive 


invariant packaging _ sig. proc. operation 
Magnetic v v v v fo) v v v 
Radar © v v v v v ra) va) 
Thermal i) © v v v ro) v v 
Acoustic ia) © v v v v v v 
Chemical v a) i) va) o @ v v 
Electric vo) o v ra) ia) v ia) ta) 
Seismic a) © @ v v v v v 
Optical @ @ @ v v @ v v 
Ultrasonic vo) © @ v va) @ © va) 


moving ferromagnetic object can be modeled as a 
moving magnetic dipole centered at (X,,VZm): 
Still more generally, the dipole position can be de- 
scribed as a function of time if x,,, yy, and z,, are 
replaced with x,,(t), y(t), and z,,(¢), respectively. 

The dipole is modeled as two equal but opposite 
equivalent magnetic charges +q,, and —q,,, sepa- 
rated by a distance /=2r, where r is the radial dis- 
tance from the dipole center to a charge. The 
orientation of the dipole is given in spherical coor- 
dinates relative to the dipole center. The zenith 
(polar) angle ¢ and the azimuthal angle 0, together 
with r, fully specify the position and orientation of 
the magnetic dipole. As before, a more general 
description of the dipole’s orientation as a function 
of time can be given by replacing the angles @ and 
6 with time dependent versions ¢(t) and 0(t) or 
position dependent versions (X,VmsZm) and 
O( Xm Vs Zm)- 

The signal detection chain for magnetic targets 
is shown in Fig. 1. The modules of this signal chain 


Moving 
Statistics 


include a limiter, finite impulse response (FIR) low 
pass filter (noise filtering), decimator, moving sta- 
tistics, constant false alarm rate (CFAR) detector, 
infinite impulse response (IIR) low pass filter (hys- 
teresis), and energy estimator. The outputs of the 
detector include signal duration and signal energy 
content. Additional modules could include a peak 
estimator and a hidden Markov model for finer- 
grained signature analysis supporting classifica- 
tion. This signal chain operates independently on 
each of the two magnetometer axes and fuses the 
readings together at each node. Such local fusing 
reduces false alarms caused by spurious noise 
along only one axis. The design philosophy of 
the signal detection subsystem is that all opera- 
tions occur in response to the arrival of new data 
samples or timer events. Sampling occurs with a 
certain predetermined frequency, /,, which is com- 
puted as a function of Vina, and the noise PSD. 

The modules of the signal chain perform the 
following functions. 


Energy 
Estimator 


Classitier 


Peak 
Estimator 


Fig. 1. Magnetometer signal chain. 
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Limiter. The limiter is a non-linear module that 
acts to limit the samples that are large in magni- 
tude in an effort by the detector to reduce the effect 
of noise outliers. Without the limiter, the Pp could 
be reduced substantially. 

Low pass filter. The finite impulse response 
(FIR) low pass filter computes a moving average 
of the signal to reduce noise and improve the Pra. 

Decimator. The decimator allows downsam- 
pling to rates more appropriate for our signal phe- 
nomenology. 

Moving statistics. The moving statistics module 
estimates the signal mean and variance over the 
previous n data samples every time a new sample 
becomes available. 

CFAR detector. The output of the CFAR detec- 
tor is true during the interval in which a target 
passes by the sensor and false otherwise. This 
module estimates the signal duration. The module 
implements a Neyman-—Pearson detector that 
works by building a histogram, which serves as a 
proxy for the probability density function, of the 
signal variance in the noise over a long period of 
time and then compares it to the (nearly) instanta- 
neous signal variance as reported by the moving 
statistics. 

Hysteresis. The hysteresis is implemented using 
an infinite impulse response (IIR) low pass filter 
over the signal variance. The IIR filter provides a 
“fast-attack, slow-decay” response (i.e., a non- 
constant phase shift). Such a response was desired 
in order to avoid breaking up a single detection 
event into multiple smaller detections. The down- 
side, however, is that stronger signals cause longer 
decay times and bias the duration estimation non- 
linearly before it is reported. 

Energy estimator. The energy estimator module 
determines the energy content of the signal of inter- 
est. The estimator begins computing the energy 
content of the signal when the output of the signal 
detector is true and stops when the output of the 
signal detector is false. The interval over which 
the energy content is computed is the duration 
of the signal. The energy is computed by subtract- 
ing the moving average, or bias, from the signal 
and then summing the squares of the samples over 
the period of the signal. An event is signaled upon 
completion of the energy content computation. 


Classifier. The classifier fuses the various 
parameters (duration, energy, etc.) and, option- 
ally, can attempt to categorize the target into one 
of several classes. 


6.2. Radar 


We use the TWR-ISM-002 pulse Doppler sen- 
sor from Advantaca as our radar platform. This 
sensor detects motion up to a 60 ft radius around 
the sensor but this range is adjustable to a shorter 
distance using an onboard potentiometer. The 
unit’s sensitivity can also be adjusted in a similar 
fashion, depending on environmental considera- 
tions like proximity to the ground and presence 
of clutter. 

These sensors output an analog signal that var- 
ies from 0 to 2.5 V and is nominally centered at 
1.25 V when there is no motion. The analog output 
varies between 0 and 2.5 V when there is motion 
toward or away from the radar. The output signal 
is a sinusoid (potentially clipped) at the Doppler 
frequency and is proportional to the radial compo- 
nent of the target’s velocity. (in the direction to- 
ward or away from the radar). The clipped 
sinusoidal output signal encounters a zero crossing 
(or 1.25 V bias, in this case) for every 4/2 units of 
distance the target travels. The radar sensor’s oper- 
ating frequency f equals 2.4 GHz, giving us a 
wavelength 1=3.0x10°/2.4x 10°=12.5 cm. There- 
fore, the analog output encounters a zero crossing 
(1.25 V) for every 2/2 = 6.25 cm of travel toward or 
away from the sensor. The analog output returns 
to 1.25 V when motion stops. The elapsed time 1, 
between successive zero crossings is inversely pro- 
portional to the target’s radial velocity (the target’s 
velocity along the sensor’s line of sight) with a pro- 
portionality constant of 7/2. Therefore, the radial 
velocity v,.=2/2t.. The radar signal detection 
framework is similar to the one used for the mag- 
netic signal detection. 

Range estimation from Doppler signals is a 
promising approach when targets maintain con- 
stant heading but non-constant speed, as might 
be the case along a fixed stretch of roadway. In 
our case, however, the kinematic model for both 
soldiers and vehicles allow for changes in speed 
and bearing. As a result, even though we can com- 
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pute range for a constant heading target, we can- 
not do so robustly in the general case of arbitrary 
motion using the available Doppler-based radar 
motion sensors. Instead, we estimate the area in 
which a target is detected using sensors operating 
in a binary mode by providing presence and ab- 
sence detection. We develop this estimator in Sec- 
tion 7 and use it as the basis for our classifier. 


7. Classification 


The goal of classification is to correctly label a 
target as belonging to one of several classes includ- 
ing person, soldier, and vehicle. In Section 5, we 
noted that vehicles contain significantly greater 
amounts of metallic mass than soldiers and conse- 
quently vehicles magnetically affect much larger 
areas than soldiers do. In general, each ferro-mag- 
netic target class has a minimum and maximum 
area in which it disrupts Earth’s ambient magnetic 
field in a manner that is detectable by our sensors. 
In this section, we formalize the notion of this 
area, called the target’s “influence field,” develop 
a distributed estimator for it, and analyze the esti- 
mator’s performance for varying degrees of net- 
work reliability and latency. Finally, we address 
the question of discriminating a person from a sol- 
dier and vehicle through the use of sensor fusion. 


7.1. The influence field as a spatial statistic 


In Section 6, we informally described the need 
for and benefit of measuring the influence field, 
or the size of the area in which a target can be de- 
tected. In practice, the influence field is (the union 
of) the area(s) bounded by the curve(s) of equipo- 
tential field strength where the signal-to-noise ratio 
exceeds the sensor’s minimum detectable thresh- 
old. Since the size and shape of this area could 
change as a function of sensor calibration and sen- 
sitivity, noise power, and other nuisance parame- 
ters like target orientation, the area is bounded 
by a maximum and minimum value. The influence 
fields of different target classes may be different 
from one sensing modality to the next: a vehicle 
will have a larger magnetic influence field than a 
soldier but a soldier may have a larger acoustic 


influence field than a vehicle if the soldier is firing 
a gun. 

The following example will serve to further 
illustrate this concept. Assume that nodes are de- 
ployed with a density of p and that the nominal 
area of the influence field lies in the range [Amin, 
Ayax| Then, the number of sensors, n, that can 
simultaneously detect the object is given by the 
range [Aminp, Amaxp]. If target classes do not have 
overlapping influence field ranges, then the system 
can discriminate between target classes by examin- 
ing the value of n. For example, assume a regular 
grid on 5-foot centers giving a deployment density 
of p=1/57=0.04 sensors/sqft, and a target with a 
minimum and maximum influence radius of 12 
and 15 ft, respectively. Then, Amin = m127=452 sqft 
and Amax=115°=707 sqft. We find that between 
Mmin = Aminp = 0.04X452=18 and Mmax=Amaxp= 
0.04x 707 = 28 sensors will detect the target’s pres- 
ence at a single point in time. Given the same 
deployment density, assume a second target with 
a minimum and maximum influence radius of 5 
and 8 ft, respectively. Then, Ayin=725°=79 sqft 
and Aymax=18°=201 sqft. We find that between 
Mmin = Aminp = 9.0479 = 3 and Mmax= Amaxp = 9.04 
201=8 sensors will detect the second target’s pres- 
ence at a single point in time. 

For practical reasons, we associate with the 
influence field the notion of a window of time in 
which the target is detected. There are several fac- 
tors that influence the choice of the size of this win- 
dow. The number of nodes that can detect a 
moving target in a given interval of time may de- 
pend upon the size of the object, the amount of 
metallic content and hence the range at which it 
can be detected by a magnetometer, the velocity 
of the target, and the number of sensors in the re- 
gion around the target. Therefore, we must con- 
sider the density of node deployment and the size 
and speed of the target types. Referring back to 
the target motion models in Section 3, we identify 
the smallest and the slowest moving ones as well 
as the largest and fastest moving ones. The 
amount of time required to process the data for 
a given window must be less than the window 
duration in order to meet the needs of a real-time 
online system. We are also concerned with the 
concurrent detection of the same event at different 


620 A. Arora et al. | Computer Networks 46 (2004) 605-634 


sensors because of differences in the hardware, the 
sensitivity of sensors, or the parameters of the 
detection algorithm running at the sensor node. 
For instance, a fast-attack, slow-decay detector, 
like the one used in our signal detection software, 
can affect sensors in a non-linear and non-deter- 
ministic manner, causing perceived time differences 
between the starts and ends of detections at differ- 
ent nodes for the same event. This uncertainty in 
detection duration, which can be as large as 500 
ms, also affects the size of the influence field win- 
dow. Finally, we also have to factor in the effect 
of network unreliability on the number of mes- 
sages corresponding to the detection events that 
are actually received at the classifier. Based on 
these factors, we selected 500 ms as the width of 
the influence field window. 

Given the window size required for classifica- 
tion, we must verify that detection events occur- 
ring at the same physical time are timestamped 
accordingly with values that will fall within the 
same window of global network time at the classi- 
fier. In order to achieve this common timebase, a 
time synchronization service is needed that will 
maintain an estimate of global time at each node. 
This service also needs to guarantee that the max- 
imum difference in the estimates of any two nodes 
in the network does not exceed some fraction of 
the classifier window size. For instance, for a win- 
dow size of 500 ms and a classification accuracy 
exceeding 99%, we require that the accuracy of 
the time synchronization service to be within 1% 
of 500 or 5 ms. 


7.2. Classifier design 


The classifier collects data received from the 
network and partitions it into windows of global 
time. Once the incoming data has been partitioned 
into windows based on global time, the classifier 
counts the number of nodes that have detected 
the presence of a target in that window. To con- 
serve the network bandwidth, nodes simply report 
the start and the end of a detection event. Hence, 
the classifier has to maintain a history of nodes 
that have started detecting an event but have not 
yet stopped detecting it. The classifier carries for- 
ward the count of such active nodes from one win- 


dow to the next. Further, all detection events in a 
classification window need not belong to the same 
target. For instance, if multiple targets are simulta- 
neously in the network, each target will be detected 
by the nodes in the region surrounding it. The clas- 
sifier distinguishes multiple targets and does not 
combine these simultaneous detections into a sin- 
gle larger target. 

Wind and other sources of noise can cause 
nodes to report false detections. The classifier iden- 
tifies such outliers that could skew the classifica- 
tion. To achieve this, the classifier uses 
localization information about the reporting nodes 
and knowledge of the target motion and phenom- 
enological models. For example, if the classifier re- 
ceives only two detection events and the influence 
field for the smallest target type, the soldier, is ex- 
pected to be between 4 and 9 for the given density 
considering 50% network reliability, the classifier 
identifies these nodes as outliers and does not gen- 
erate a classification. If, on the other hand, the 
influence field for a soldier is nine while that for 
a car is 36, and if four soldiers walk through the 
network at the same time such that they are at suf- 
ficient distance from one another, the classifier 
identifies that the corresponding events belong to 
different targets and accurately classifies the tar- 
gets as four soldiers rather than a single car. Note 
that the data association problem is automatically 
addressed because of the fine-grained spatial local- 
ity of the detections. The output of the classifier at 
the end of each classification window is one or 
more classification decisions along with the sup- 
porting evidence, in the form of a set or sets of 
nodes, that are associated with the given target. 

Classifier latency is an important tunable 
parameter that governs the length of time that 
the classifier waits between receiving the first detec- 
tion event and providing the first classification re- 
sult. The classifier masks detection events until it 
has received a sufficient number of samples to 
achieve the desired probability of false alarm, 
Pra. In addition, the classifier introduces a delay 
while waiting for enough samples to report a 
meaningful classification. Consequently, the classi- 
fier latency is only one of two components that 
contribute to the overall system latency. The other 
component of system latency is the latency be- 
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Fig. 2. The shape of the influence field of a soldier vs. a vehicle. 


tween detecting a target at the sensor node and 
reporting that detection to the classifier. We inves- 
tigate the classifier performance as a function of la- 
tency in the next section. 


7.3. Validation 


A theoretical model of a target’s influence field, 
parameterized with the target’s size, speed, head- 
ing, inclination, location, and ferro-magnetic con- 
tent can be used to demonstrate that the 
probability density functions of the various target 
classes are discriminable. However, an accurate 
model of a target’s influence field may be difficult 
to achieve without incorporating many nuisance 
parameters and even still may require time con- 
suming finite element methods to compute. Due 
to the spatial, temporal, and class-conditional var- 
iations of the numerous nuisance parameters, we 
present a simple lumped parameter model of the 
computed strength and shape of the influence field 
for both a soldier and a vehicle in Fig. 2. The sol- 
dier is modelled as carrying a gun of length 3 ft at 
an azimuthal angle of 20°. The vehicle is modelled 
as the superposition of the influence fields of the 
engine, front axle, rear axle, transmission, spare 
tire, and steering wheel. In both cases, the positive 
y-axis is pointing toward the northwest and the 
field strength displayed is the planar projection 
of the magnetic field at ground level across the dis- 
played area. These models should convey a sense 
of the relative shape of the influence fields and 


an intuitive understanding of their discrimina- 
bility. * Since we do not know the true weights 
and variations of the parameters, we will use 
empirical methods to validate the model. 

As with any real system, experimental valida- 
tion of performance is necessary. In the case of 
the influence field as an estimator of the target’s 
class, this validation exists at three levels: the the- 
oretical influence field, the influence field as meas- 
ured by the sensor nodes, and the influence field as 
reported to the classifier. Due to the complexity of 
the theoretical model, the remainder of this section 
will focus on empirical measurements of the influ- 
ence field at the sensor nodes and its estimate at 
the classifier. The key distinction is that the esti- 
mated influence field is a noisy function of the 
measured influence field, network reliability, la- 
tency, probability of detection and false alarm, 
detector hysteresis, and nuisance parameters de- 
scribed earlier. How much “noise” is added and 
in what quantities as a result of these additional 
parameters in reality is not clear. Consequently, 
we vary a few easily controllable parameters such 
as speed, heading, network reliability and latency, 
and lump the remaining parameters. 

Fig. 3 shows the influence field probability dis- 
tributions for a soldier and a car, as actually meas- 
ured by the sensors. The measured influence field 


? Note. The field strength is not scaled the same for both 
plots. Hence, these plots demonstrate the shape but not the 
relative size of the influence fields. 
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Fig. 3. The influence field of a soldier and a car as measured at 
the sensor nodes, and their Gaussian approximations. 


of a soldier has a mean, p, of 12.2 and a variance, 
oa, of 0.44 while a car has a mean of 43.5 anda 
variance of 0.49. We overlay on this figure a pair 
of curves ~ V(12.1,1) and ~ (43.5, 1.5), 
approximating the influence field of a soldier and 
a vehicle, respectively. It should be clear from 
Fig. 3, that there exists a clear separation between 
the measured influence fields for a soldier and a 
car. Since the distributions have nearly identical 
variances, we can compute the discriminability, 
d', as 


d= lo = Hal _ 67 (1) 
oO 

which indicates a practically infinitesimal proba- 

bility of misclassification. 

We note that these influence field values are 
ideal in the sense that they are based on data ob- 
tained directly at the nodes and not necessarily 
the data that is actually available to the classifier. 
In order to evaluate system performance, we stud- 
ied the effects of network unreliability and latency 
on the classifier performance by varying the trans- 
mission power level (3, 6, 9, and 12) 3 the number 
of transmissions per message (1, 2, 3, 4, 5), and the 
classifier latency (5, 10, and 15 s). In all, we ran a 
total of 280 experiments using 16 different para- 
meter configurations (a subset of the possible 
parameter space). Analyzing the timestamped 
measurements at the nodes and at the classifier, 
we identify in Fig. 4 the parameter values which 
best demonstrate the variability in the estimator 
performance as a function of reliability and 


3 See Section 11 for a description of the hardware used. 


MAG (9,1,5) MAG (8,3,5) 


——- Vehicle 
~~~ Soldier 


Probability 


Estimated Influence Field 


Fig. 4. Probability distribution of the estimated influence field 
as a function of media access control (MAC) power, transmis- 
sions, and latency. MAC(P, T, L), where P is the power setting, 
T is the total number of transmissions, and L is the latency in 
seconds. 


Table 5 
The confusion matrix for MAC(9,1,5) assuming the 
Pc,, > 99% requirement is met 


Soldier Vehicle 
Soldier Po,.=31% Po, = 69% 
Vehicle Po, <1% Po, > 99% 


latency. We use the notation MAC(P, T, L), where 
P is the transmission power setting, 7 is the total 
number of transmissions, and L is the latency in 
seconds. 

The confusion matrix for MAC(9, 1,5) is shown 
in Table 5. The classifier performance is clearly 
unacceptable with this optimistic single transmis- 
sion per node and a classifier latency of 5 s. 

We find that increasing the latency to 10 s, as 
shown in MAC(9,1,10), improves the classifier 
performance to 100%. Recall, however, that we 
used a lumped parameter approach that did not 
attempt to characterize the influence field over 
the entire range of all possible parameters. Conse- 
quently, the probability distributions of the influ- 
ence fields would likely have greater variance 
than our test cases indicate and would likely over- 
lap, reducing the discriminability to an unaccepta- 
ble level. Since increasing the latency from 5 to 10s 
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improves the classifier performance, we are moti- 
vated to further increase latency, to 15 s, as shown 
in MAC(9, 1,15). We find, however, that no fur- 
ther improvement in discriminability results from 
this increase in latency. We still remain interested 
in improving the classifier performance, so we 
must consider other parameters. 

Turning our attention to reliability, we attempt 
to transmit each message at most three times (i.e., 
two retransmissions) and with a latency of 5 s. The 
results are shown in MAC(9, 3,5). We find that our 
attempt to increase network reliability has actually 
decreased the discriminability of the target classes 
since the probability distributions now overlap 
even more so than with MAC(9, 1,5). We attribute 
this poor performance to the increased traffic gen- 
erated from retransmissions and its attendant ef- 
fects on collision and congestion. Next, we try 
MAC(9, 3,10) and notice an improvement over 
MAC(9, 3,5) in that the discriminability has im- 
proved. We also note the MAC(9, 3, 10) results in 
a distribution whose variance is smaller than 
MAC(9, 1,10). Encouraged by the positive trends 
in both separating the means and decreasing the 
variances, we investigate MAC(9,3,15) and find 
that it offers the best discriminability. 

We notice that while MAC(9,3,15) offers the 
best overall performance, the worst case network 
reliability is approximately 50%, since only one- 
half of the detections at the nodes are actually 
available to the classifier. We also note that the 
network loss rate varies according to target class. 
There is less variation in the soldier’s influence field 
than in the vehicle’s, as estimated at the classifier 
across all of our tests. The soldier’s estimated influ- 
ence field ranges from 9 in MAC(9, 1,5) to 6.4 in 
MAC(9, 3,5), a decrease of 27% and 48%, respec- 
tively, from the measured value of 12.2. In con- 
trast, the vehicle’s estimated influence field ranges 
from 21.2 in MAC(9,3,15) to 7.7 in 
MAC(9, 3,5), a decrease of 51% and 82%, respec- 
tively, from the measured value of 43.5. In other 
words, the network delivers approximately twice 
the reliability for a soldier than it does for a vehi- 
cle. We attribute this wide variation to the different 
levels of traffic that are generated isochronously 
for the different target classes. Assuming a 10% 
margin of error in the influence field estimation 


and greater than 99% classification accuracy, we 
find that the acceptable lower bound on network 
reliability for classification is approximately 50%. 

So far, we have focused our attention on dis- 
criminating soldiers from vehicles. We now turn 
to sensor fusion in order to address the classifica- 
tion of persons, and to make our detection of sol- 
diers and vehicles more robust. Recall that the 
radar motion sensors detect all of the target classes 
but only the ferro-magnetic targets are detected by 
the magnetic sensors. Consequently, we can fuse 
these two sensing modalities into a single predicate 
that the classifier evaluates at the end of each win- 
dow to determine whether a person, and only a 
person, is present: 


person = radar A —magnetic. (2) 


We also use sensor fusion to make the detection of 
soldiers and vehicles more robust: 


soldier = radar \ magnetic A (f < x*), (3) 


vehicle = radar A magnetic A (f > x"), (4) 


where f is the estimated influence field and x* is 
the decision boundary that minimizes the classifi- 
cation error rate. In our case, x*= 14. 


8. Tracking 


Recall our tracking requirement is an accuracy 
of less than 5 m for soldiers, unarmed persons 
and vehicles moving through the network. Moreo- 
ver, we need to track multiple simultaneous targets 
moving through the network assuming they are 
separated by a sufficient distance, say 10 m. 

Algorithm. We use the same influence field con- 
cept as used for classification for tracking intrud- 
ers moving through the network. The classifier 
calculates the influence field of an intruder or mul- 
tiple intruders moving through the network. It also 
performs the task of separating false alarms from 
real intruders and distinguishing multiple intruders 
moving through the network at different locations, 
using localization information. The classifier then 
passes to the tracking module in each window of 
time, a set or sets of nodes constituting each clas- 
sified intruder and the intruder type. When the 
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tracking module receives such a classifier output 
for the first time, it tags it as a new intruder. It then 
estimates the most likely location for each intruder 
as the centroid of the convex region enveloping all 
the nodes detecting it. Depending on the type of 
intruder and the current estimated position, the 
tracking module also computes an expected region 
for the intruder to be located in the next window, 
based on the velocity of the intruder type. It then 
correlates the tracked objects from successive win- 
dows in order to construct a continuous track per 
intruder for the entire time it spends in the net- 
work. If the estimated location of an intruder does 
not lie in the expected regions of any of the cur- 
rently tracked intruders, a new intruder is detected 
and a new track is created. 

Implementation considerations. The accuracy of 
tracking the intruder location using a centroid ap- 
proach is fairly good in case of a perfectly reliable 
network. However, due to network unreliability, 
the set of nodes received by the tracking module 
is only a non-deterministic subset of the nodes that 
actually detect the intruder. Hence, the tracking 
module has to first perform some kind of a 
smoothing or filling algorithm to reduce the effects 
of network noise. To achieve this, we use a heuris- 
tic called the Bounding Box, which 1s defined as the 
tightest convex region that can be fit around the 
set of nodes detecting the intruder whose messages 
are received. The soundness of the bounding box 
method lies in the fact that the classifier performs 
detection of false positives and outliers, hence the 
input to the tracking module consists of legitimate 
intruder detections. The tracking algorithm also 
uses information from the intruder model about 
the spacing between multiple intruders moving 
concurrently through the network in order to 
accurately compute bounding boxes for multiple 
intruders and not confuse them as part of a single 
large intruder. The tracking module now estimates 
the location of each intruder as the centroid of its 
computed bounding box. 

Results. Based on the influence field approach 
and using the bounding box heuristic, we were able 
to meet the prescribed accuracy requirements. The 
system is able to track soldiers and unarmed per- 
sons with an accuracy of 1-2 m and vehicles with 
an accuracy of 3-4 m. The system can also accu- 


rately track multiple soldiers or vehicles separated 
by a distance greater than 10 m moving simultane- 
ously through the network. 


9. Time synchronization 


As described in the derivation for the influence 
field and the size of the classifier window, we re- 
quire that observations occurring at the same 
physical time need to be timestamped with values 
differing by not more than 5 ms in order to achieve 
the desired classification accuracy. This imposes an 
accuracy requirement on the time synchronization 
service, 1.e., the time values of any two nodes in the 
network cannot differ by more than 5 ms at any 
time instant, which translates to a per-hop accu- 
racy of less than 500 ps. 

An important requirement of the time synchro- 
nization service is that it should be robust to node 
and link failures. Our first implementation of time 
synchronization was based on the traditional span- 
ning tree based algorithm for synchronizing 
clocks. In this algorithm, a distinguished node 
periodically sends time values along a spanning 
tree structure. However, this algorithm, while pro- 
viding good accuracy, suffers from the drawback 
of depending on a relatively static structure for 
time dissemination and hence performs poorly in 
the presence of unreliable nodes and links and net- 
work partitions. For this reason, we designed a 
truly distributed time synchronization service that 
is robust to these commonly occurring faults in 
sensor networks. 


9.1. Algorithm 


The basic idea behind our time synchronization 
algorithm is that of locally synchronizing to the 
fastest clock. In this scheme, each node maintains 
a local clock which is never changed and an esti- 
mate of network time which is stored as an offset 
with respect to the local clock. Each node broad- 
casts its network time value periodically and re- 
ceives time values from its neighbors. If a node 
receives a time value greater than its own, it ad- 
justs its local time to that value, otherwise it 
ignores the value received. Thus, the entire net- 
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work synchronizes to the maximum clock value in 
the network. This scheme also guarantees that the 
timestamp values at every node are monotonically 
increasing. 

This time synchronization algorithm is purely 
distributed, local, and does not depend on a fixed 
structure for disseminating time values. Conse- 
quently, even if a single node or link fails, the 
other nodes can receive time values from the rest 
of their neighbors. The protocol is thus robust to 
individual node and link failures. Node joins are 
also easy to handle as the new nodes have lower 
time values and hence catch up with the rest of 
the network and do not force other nodes to roll 
back their clocks. The algorithm can also handle 
network partitions in the sense that the nodes in 
each partition synchronize to the maximum time 
value in that partition. These properties of robust- 
ness to network dynamics like failures, joins, and 
partitions make this protocol suitable for mobile 
environments as well. We demonstrated the 
robustness of the time synchronization scheme in 
a mobile setting by partitioning a group of sensor 
nodes into two subgroups, each of which synchro- 
nized to the maximum value in its partition. We 
showed that whenever a node moved from one 
partition to another, it would either catch up with 
the time in the new partition or the new partition 
would catch up with the moving node’s time and 
consequently the original partition. In the pres- 
ence of node mobility in both directions, the pro- 
tocol converges to synchronize both partitions 
with high accuracy even if no two nodes in either 
partition can communicate with each other di- 
rectly. 


9.2. Accuracy 


The accuracy provided by the time synchroniza- 
tion service depends on the node and network re- 
sources available to the service. On the network 
side, accuracy increases as the frequency of the 
periodic message exchange increases. On the node 
side, accuracy can be improved using skew calcula- 
tions. In the basic version of the protocol, when- 
ever a node receives a higher time value than its 
own, it copies the received value. However, this 
is inaccurate because the time value at the sender 


of that time has already moved forward by the 
time the value is copied. The amount by which 
its clock has moved forward is the sum of the time 
taken by the node to send out the message after 
timestamping it, the message transmission time 
and the time spent in receiving the message, com- 
paring its time value and copying it. To complicate 
matters, this elapsed time may be non-determinis- 
tic in case of random waiting or backoff strategies 
for channel access. The accuracy of the time syn- 
chronization service can be greatly improved by 
estimating this elapsed time. This calculation re- 
quires the sending of additional information in 
each message and additional processing at each 
node. In order to avoid errors due to non-deter- 
ministic delays, the stamping and copying of time 
values can be done at the MAC level just before 
the message is transmitted and just after it is re- 
ceived. 


9.3. Results 


Our experiments demonstrate that the basic 
time synchronization algorithm meets the level of 
accuracy desired by the application, as can be seen 
from Table 6. 

Our results also show that accuracy improves 
significantly when time synchronization is imple- 
mented as close to the hardware level as possible. 
Moreover, accuracy can be further improved using 
skew compensation techniques. 

It should be noted that in large scale networks, 
where the amount of message traffic received is 
high, processing time synchronization values at 
the level closest to hardware can be risky. Because 
of the overhead of extra computations at the low- 
est level, processing of time synchronization mes- 
sages might be preempted by other low level 


Table 6 
Accuracy of the time synchronization protocol 


Time synchronization scheme Per-hop 


accuracy (1s) 


Basic algorithm (local maxima based) 305.1 
Basic algorithm + low-level processing 19.25 
Basic algorithm + low-level 10.9 


processing+skew compensation 
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events resulting in arbitrary state corruptions if 
not programmed or scheduled carefully. 


10. Communications and networking 


Section 7 demonstrated the importance of net- 
work reliability. In this section, we consider both 
routing and reliable communications between 
neighboring nodes. 


10.1. Routing algorithm 


The limited transmission range of sensor nodes 
implies that all nodes are not within direct trans- 
mission range from the classifier. We thus need a 
routing service to direct messages from any node 
in the network to the classifier. The dynamic nat- 
ure of the wireless communication medium often 
results in the formation of unstable, long links in 
the network [18,19]. These unstable links, if part 
of the routing structure, result in frequent route 
changes. One approach to deal with such links in- 
volves dynamic link estimation to determine the 
set of stable links [19]. We opt for a simpler rout- 
ing protocol that is both reliable and lightweight in 
terms of communication, computation and mem- 
ory requirements. By tuning the transmission 
power level of the sensor nodes, we find that it is 
possible to guarantee that links in the routing 
structure will be stable. For these reasons, we de- 
vised a simpler routing protocol than the more tra- 
ditional distance vector protocol available. We call 
this routing protocol the Logical Grid Routing 
Protocol or LGRP. 

LGRP uses the localization or neighborhood 
detection service to determine a set of reliable 
nearby neighbors. These nodes are called the logi- 
cal neighbors. A node can determine which of its 
logical neighbors are closer to the root than it is. 
Neighbors closer to the root are called a node’s 
low neighbors, and neighbors farther from the 
root are called a node’s high neighbors. A node 
limits its choices for selecting a parent in the rout- 
ing structure to these logical neighbors. This sim- 
ple scheme for neighbor selection helps avoid the 
formation of unstable long links in the routing 
structure. The root node periodically transmits 


beacons in order to construct and maintain a rout- 
ing tree. The logical neighbors of the root receive 
these beacons and set the root to be their parent. 
These one-hop neighbors of the root then start 
propagating their own beacons. Upon receiving a 
beacon from a logical neighbor, a node selects it 
as its parent if it is a low neighbor. In case a node 
does not receive any beacons from low neighbors, 
a node selects a high neighbor as its parent. How- 
ever, since such inverse links can lead to loops in 
the routing structure, the protocol limits the max- 
imum number of inverse links that a path from a 
node to the root can contain. 

LGRP is self-stabilizing and can tolerate node 
failstops. If a node misses a certain threshold of 
beacons from its parent, it suspects that its parent 
is no longer available and tries to select a new par- 
ent according to the protocol. The protocol is sim- 
ple and lightweight, and does not tax the resources 
of the node or the network by exchanging frequent 
messages and performing dynamic estimations. Fi- 
nally, LGRP provides a reliable and stable routing 
structure in a wireless sensor network, and hence is 
suitable for the requirements of our system. 


10.2. Reliable communications 


The influence field feature and its validation 
mandate that the network has to provide a worst 
case end-to-end reliability of about 50% under 
the traffic generated by the different target types 
to satisfy the desired classification goals. However, 
messages sent over the wireless network are subject 
to loss as a result of collisions and fading of the 
radio signals during propagation through the med- 
ium. These sources of message loss adversely affect 
the end-to-end reliability of the network and we 
observed an effective reliability of less than 50%, 
resulting in poor performance of our classifier. 
Hence, we designed a reliable communications 
service, called ReliableComm, whose goal was to 
improve per-hop and end-to-end reliability in the 
presence of fading, collisions, and congestion. 

ReliableComm makes extensive use of implicit 
acknowledgements. Whenever a node forwards a 
message to its parent on behalf of its child, this for- 
warded message is also received by the child, there- 
by serving as an acknowledgement for the child’s 
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message to the node. Every node in the network 
maintains a queue of messages. A node transmits 
the message at the head of its queue and starts a 
timer which fires after a timeout interval. Any mes- 
sages received after this period are enqueued for la- 
ter transmission. If the node receives an implicit 
acknowledgement from its parent before this timer 
expires, it knows that its parent received the mes- 
sage and hence removes the corresponding message 
from its own buffer. If the acknowledgement is not 
received before the timeout, the node assumes that 
the parent did not receive the message, retransmits 
it and starts a new timer and waits for an acknowl- 
edgement. This process is repeated until either the 
node receives an implicit acknowledgement from 
its parent or the node has attempted a certain 
threshold number of retransmissions, which is a 
tunable parameter of this service. At the last hop, 
the root does not have to forward the message 
and so it explicitly acknowledges receipt of the mes- 
sages on the last hop. 

ReliableComm provides an efficient implemen- 
tation of the implicit acknowledgement idea and 
hence meets the requirement of being lightweight. 
The concept of logical neighbors in LGRP bounds 
the number of children that a node can have in the 
routing structure. Consequently, the size of the 
queue maintained by a node in ReliableComm is 
also bounded, making it efficient in memory utili- 
zation. It is possible in the implicit acknowledge- 
ment scheme that despite having correctly 
received a message from a child, the parent has 
not yet forwarded the message due to other mes- 
sages in the queue. In order to avoid unnecessary 
retransmissions in the case of successful reception, 
ReliableComm uses an optimization by which a 
node cumulatively acknowledges all the messages 
in its queue with each outgoing message. Here 
again, the bounded size of the node queue ensures 
that all messages in the queue can be acknowl- 
edged in each outgoing message. In the event that 
a node misses this implicit acknowledgement and 
retransmits the message, ReliableComm maintains 
a sequence number of the last message received 
from each child, thereby avoiding unnecessary 
re-queueing and retransmission of duplicate mes- 
sages. Once again, the bounded number of chil- 
dren bounds the memory required at each node. 


ReliableComm thus provides an efficient implicit 
acknowledgement scheme that exploits the broad- 
cast nature of communication to piggyback the 
acknowledgement on the forwarded message, 
thereby conserving network bandwidth. 

The level of reliability provided by the Reliable- 
Comm service depends on several tunable para- 
meters. The overall end-to-end delivery increases 
in general, as the number of retransmissions is in- 
creased, although in the worst case the reception 
latency also increases when the network is con- 
gested simply because messages may arrive at the 
base station after being retransmitted an increas- 
ing number of times for each hop. The transmis- 
sion power level is also a key factor affecting the 
reliability of the network. Clearly, nodes have to 
transmit messages with enough power so that these 
messages will reach a node’s parent with high 
probability despite the effects of fading in the 
channel. However, our experiments show that the 
interference range of a node is almost two or more 
times its high-probability transmission range. 
Hence, transmitting at a power level higher than 
necessary may lead to increased collisions in the 
network, thereby reducing network reliability. 


10.3. Experimental results 


As with the influence field feature, we performed 
several experiments in order to validate that the 
instrumentation of end-to-end reliability met the 
requirements imposed by the desired classification 
accuracy. The experimental setup was similar to 
the one used for the influence field calculations, ex- 
cept that each node upon detecting an intruder in 
its range, now also sent a start and a stop message 
indicating the start and end of the detection event, 
over the network to the classifier connected to the 
root of the routing structure. This message con- 
sisted of a single start or stop bit along with a time- 
stamp and source information. Because of the 
network unreliability, the classifier received data 
from only a subset of the transmitting nodes. More- 
over, this data was out of order and possibly dupli- 
cated because of retransmissions at the last hop in 
the network. In order to negate the effects of mes- 
sage reordering and accurately calculate the influ- 
ence field for an intruder, we introduced a delay 
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in processing at the classifier. This processing la- 
tency ensures that the classifier receives the desired 
number of messages over a moving window before 
processing the messages that originated in the net- 
work during that window. In our most detailed 
experiment, we performed 280 trials consisting of 
16 different combinations of parameters including 
transmission power level, maximum number of re- 
transmissions, retransmission timeout, etc. The key 
results of these experiments are described in Section 
7, supporting the notion of co-design. 

Fig. 4 with MAC(9, 1, x) shows the experimen- 
tally measured probability distributions of the 
influence fields for a soldier and a car as aggregated 
at the classifier. Fig. 4 with MAC(9, I, 10) is the best 
distribution obtained without using Reliable- 
Comm while Fig. 4 with MAC(9, 3, 15) is the distri- 
bution under the best network reliability obtained 
using ReliableComm with the number of maxi- 
mum retransmissions at each hop being set to 2. 
The transmission power level in both these cases 
was the same “* and it yielded the best performance 
for the inter-node spacing in our experiments. 

We were able to meet the desired goals of clas- 
sification accuracy only by instrumenting reliabil- 
ity in the network. However, this accuracy came 
at the cost of increased latency overhead of 13 s 
as a result of using ReliableComm, causing the 
system to perform with a latency that did not meet 
the original specification. The increased latency 
caused much consternation among observers but 
given the choice between latency and classification 
error, increased latency was seen as less trouble- 
some. These results demonstrate a tradeoff be- 
tween speed and accuracy that is central to 
system co-design. 


11. Implementation 


During the spring, summer, and fall of 2003, we 
repeatedly deployed a 90-node sensor network at 
three different sites in Ohio and Florida to test 
the entire system described in this paper. We also 
deployed dozens of networks consisting of a smal- 


4 A power level setting of “9” on our sensor network nodes. 


ler number of nodes to test various subsystems 
including detection, classification, tracking, time 
synchronization, and routing at several additional 
sites in Ohio, Michigan, Iowa, and Texas. This sec- 
tion examines the system architecture, sensor node 
hardware, packaging, and visualization used in 
some of these experiments. 


11.1. System architecture 


Our experiments are based on a network of 78 
magnetic sensor nodes arranged in a 60x25 ft lay- 
out as shown in Fig. 5. Overlayed on this network 
is 12 additional radar sensor nodes co-located at 
nodes 2, 3, 6, 7, 28, 29, 34, 35, 67, 68, 76, and 
77. The magnetic sensor nodes are distributed uni- 
formly in this region except for along two “trails” 
where the nodes are ‘“‘pushed aside”’ to the edges of 
the trails. The trails are wide enough to allow a 
vehicle to drive through without running over 
the nodes. The nodes in the network are numbered 
0-77 and the network is connected to a remote 
computer via a base station (node 0) and a long- 
haul radio repeater. 


11.2. Network nodes 


The Mica2 mote, a derivative of the Mica fam- 
ily of motes developed at UC Berkeley [14], served 
as our network node. The Mica2 offers a 4 MHz 
Atmel processor with 4 kB of random access mem- 
ory, 128 kB of FLASH program memory, and 512 
kB of EEPROM memory (for logging). The motes 
run the TinyOS operating system [20], and are pro- 
grammed using the NesC language [21]. The 
Mica2 mote is shown in Fig. 6. 


3a 3 35 
Length (ft) 


Fig. 5. Sensor network layout. 
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(a) (b) (c) (d) (e) 


Fig. 6. Sensor hardware from left to right: (a) Mica2 network node; (b) Mica sensor board; (c) Mica power board; (d) TWR-ISM-002 


radar board, and (e) all of the boards attached together. 


11.3. Sensor boards 


Sensing of magnetic fields was accomplished 
using the Mica Sensor Board that is a part of the 
Mica family. We also integrated the TWR-ISM- 
002 radar motion sensor from Advantaca to detect 
moving persons, soldiers, and vehicles. In order to 
integrate the radar sensors with the Mica2 motes, 
we developed the Mica Power Board [22] which 
contains a pair of boost regulators and is capable 
of powering the radar board. The Mica Sensor 
Board, Mica Power Board, and Radar Board is 
shown in Fig. 6. 


11.4. Packaging 


The environment in which the sensors operate 
was described in Section 3. The sensor enclosure 
was designed to minimize the likelihood of envi- 
ronmental effects of wind, rain, snow, and terrain. 
For example, the final enclosure design is a smooth 
cylindrical capsule that minimizes wind resistance. 
The enclosure is manufactured from a clear acrylic 
or Lexan“ material to allow sunlight to pass 


through and illuminate a solar cell. The end caps 
are screwed down at four points and could be aug- 
mented with O-rings to ensure a water-tight seal. 
The electronics are mounted on a single gimbal 
mechanism which, when coupled with the rotation 
degree of freedom of the cylindrical enclosure, sig- 
nificantly increases the likelihood that the electron- 
ics will be co-planar with the ground. The 
enclosure design is shown in Fig. 7(a). 


11.5. Visualization 


Fig. 7(b) shows the software for visualizing the 
sensor nodes and targets. This software includes 
support for zooming in and out, replaying recent 
history, viewing the network topology, and dis- 
playing estimated target tracks. 


12. Key lessons 
As shown in earlier sections, network unreliabil- 


ity, resource constraints, and network size yield 
nontrivial challenges in the design, implementation, 


(a) 


(b) 


Fig. 7. (a) Enclosure and (b) the software for visualizing the network and targets. 
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testing, and analysis of the application and the net- 
work services. Several of these challenges are not 
readily accommodated by traditional methods. To- 
wards focusing attention on methods that need to be 
better addressed for fielding large scale sensor net- 
work applications, we identify in this section a num- 
ber of lessons that we learned during this project. 


12.1. Impact of network unreliability 


Existing methods for a number of problems in 
sensor networks, including classification and 
tracking, often assume that the network is reliable. 
However, our experience and recent literature 
[19,23,24] corroborate that communication in 
dense sensor networks is significantly unreliable. 
While the unreliability can be partly attributed to 
the quality of hardware, available resources, and 
the nature of the wireless media, we find that mes- 
sage collision—both direct and indirect—is a key 
underlying factor. Collisions are positively corre- 
lated with the scale and density of the sensor net- 
work and the amount of traffic that is generated. 

We learned that network unreliability cannot be 
ignored in the design of the network services or the 
application. In fact, satisfying the application 
requirements required hand-in-hand selection, de- 
sign, and tuning of the network services and the 
application components. By way of a simple illus- 
tration, Fig. 4 shows that the latency parameter se- 
lected for the classification application depends on 
our choice of the end-to-end message delivery pro- 
tocol and the number of retransmissions parame- 
ter selected in the latter depends on the accuracy 
requirements of the former. We thus argue that it 
is important to develop methodology for co-design 
of network services and application components 
and to study sufficient conditions under which 
the two can be systematically decoupled. 


12.2. Testing at scale 


Our experience includes multiple instances in 
which network services and applications tested 
for a certain number of nodes failed to satisfy their 
requirements when they were scaled up by an or- 
der of magnitude. For instance, the reliable com- 
munications service achieved better than 95% 


reliability when tested with 9-16 nodes but its reli- 
ability fell to 50% when tested with 100 nodes 
where the background and application traffic lev- 
els increased significantly. 

We learned that system scale must be consid- 
ered at the time of testing. Fine-grain testing is 
desirable, whereby individual network/applica- 
tion-level implementations can be tested in the 
presence of simulations of the other services and 
in components. Realistic modelling of the applica- 
tion, the environment, and the network (topology 
and services) is important to this end. We thus ar- 
gue that it is important to develop an integrated 
simulation and testbed environment early in the 
application development process. 


12.3. Unanticipated faulty behavior 


Sensor nodes fail frequently and in complex 
ways. Failures range from node failstops to tran- 
sient state corruptions to unanticipated, unpredict- 
able program behavior. We experienced several 
failures of the last category, as a result of undetect- 
able incorrectly downloaded programs, depleted 
energy levels, debonding of sensors or other com- 
ponents, desensitization of sensors over time, and 
extreme environmental conditions (e.g., heat, 
moisture, and water). While all of our protocols 
could self-stabilize in the presence of node failstops 
and transient faults, they could not always self-sta- 
bilize in the presence of unanticipated, unpredicta- 
ble behaviors. The result in those cases was 
sometimes quite serious, with a few misbehaving 
nodes affecting the entire network or application. 
For example, a node would constantly detect false 
events when its sensor board was overheated or de- 
bonded. Such faults led to the incorrect generation 
of a large amount of detection message traffic at a 
single node. ‘“‘Jabbering”’ nodes effectively disabled 
all communications to the operational nodes in its 
neighborhood. 

We learned that some complex faults are readily 
dealt with by better packaging, hardware and by 
incorporating redundancy techniques, but for the 
rest it is necessary to provide support to detect, 
contain, and correct them. In particular, the detec- 
tion and correction of local invariants or contracts 
was useful, e.g., to control jabbering nodes to not 
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communicate events at a rate higher than normal. 
We note that there is a considerable body of theo- 
retical work that deals with node failstops, tran- 
sient state corruptions, and Byzantine behavior, 
and argue that it is important to demonstrate the 
applicability of this work to sensor networks. 


12.4. Quality of network reprogramming 


As the number of network nodes grows and the 
complexity of the application scales, the need for 
node reprogramming—even during operation— 
grows. The distributed nature and scale of large 
sensor networks will make reprogramming by 
hand practically impossible. Reprogramming via 
the network is thus highly desirable. 

We learned that on-the-fly network reprogram- 
ming must contend with the network unreliability 
before it can be efficient, reliable, and scalable. 
Message losses and corruptions during program 
download over the network resulted in poor per- 
formance and arbitrary node failures in the first 
generation of sensor network reprogramming serv- 
ices. Specifically, the amount of time it took to 
program each node was too long, the number of 
nodes that could be simultaneously programmed 
was not high enough, and, as we noted above, 
there were scenarios in which nodes were undetec- 
tably programmed in an incorrect manner, which 
yielded Byzantine behavior. We note that very re- 
cently there have been some promising first steps 
that have been taken towards addressing aspects 
of this problem [25,26]. 

Incidentally, while reprogramming is desirable 
when the node program evolves in an unantici- 
pated way, we encountered several scenarios in 
which observation and control of known node 
parameters was desirable. As mentioned above, 
network and application level parameters are co- 
dependent, and so the monitoring and tuning 
was an on-going process that benefited from a 
light-weight alternative to reprogramming. We 
were thus led to developing services for systemati- 
cally exposing, accessing, and controlling parame- 
ters via monitoring and tuning interfaces. Such 
fine-grained services were successful in enhancing 
the observability and controllability of our sensor 
network application. 


13. Conclusions and future work 


This paper reports on our experiences develop- 
ing and fielding an experimental wireless sensor 
network for distributed intrusion detection. The 
key elements of this problem include detection, 
classification, and tracking. The influence field, a 
novel spatial statistic useful for classification is de- 
fined, and a distributed estimator for it is devel- 
oped and tested. We find that the estimator 
performance varies for different target classes 
and network reliability levels. Consequently, we 
treat the unreliability of the network as a first-class 
parameter and simultaneously evolve the network 
reliability and application performance to achieve 
acceptable results. We believe our work is unique 
in that it explicitly details the degradation in appli- 
cation performance in sensor networks as a func- 
tion of network unreliability. Our experimental 
observations are based on more than a thousand 
empirical tracks tested at a dozen sites including 
multiple deployments at MacDill Air Force Base 
in Tampa, FL. Based on this nearly year-long 
study, we identify several lessons that will be of 
practical value to sensor network designers. 

It is a widely held notion that someday there 
will be sensor network deployments consisting of 
hundreds of thousands of nodes. The challenges 
involved in scaling to a network of this size are 
quite different than the ones encountered in field- 
ing much smaller networks. Obviously, the funda- 
mental services of detection, estimation, 
classification, tracking, time synchronization, 
localization, and routing will remain important. 
However, the key challenges will center around 
robustness in the face of unreliability and incom- 
plete information. Research efforts drawing from 
self-stabilization [27], recovery-oriented comput- 
ing [28], and autonomic computing [29] may 
provide a new foundation for robust and self-reg- 
ulating sensor networks. 

Our future research efforts will explore the new 
regime of autonomic sensor networks that are truly 
self-regulating in a manner similar to the auto- 
nomic nervous system. To motivate initial inves- 
tigation into this area that is well grounded 
in experimental work, we are in the process of 
designing, building and testing a sensor network 
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consisting of more than 10,000 nodes and span- 
ning 10 km. This goal represents a scale that is 
impossible to achieve without incorporating many 
elements of autonomic sensor networks. 
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